PRISM: Private Retrieval of the Internet’s Sensitive Metadata Ang ChenAndreas Haeberlen University of Pennsylvania

Motivation: Internet-wide threats 1 Internet-wide threats: Example: Botnet detection, DDoS backtrace, … Bots scattered in many domains But victims only see local ‘views’. AS5 AS2 AS3 AS4 AS1 Bob Spoofed traffic bot traffic Who is attacking me?

Having multiple data sources helps 2 Detect attacks using multiple domains’ data Multiple data sources are better than one! Example: DDoS detection with 98% accuracy on four domains’ data [Chen-TPDS-2007] Bob Query AS5 AS2 AS3 AS4 AS1

Simple to write, hard to implement 3 Toy example: top ASes that generate darknet traffic: SELECT TOP 10 flow.SourceAS FROM JOIN Internet BY FlowID WHERE flow.destIP IN Darknet Privacy concern: all data is not available in a single place! Bob Top ASes with illegal traffic? AS5 AS2 AS3 AS4 AS1

An Internet “knowledge plane” 4 A long-standing vision [Clark-SIGCOMM-2003] Internet produces data about itself Allow real-time queries on metadata You can know what is happening where, when Benefits: DDoS backtrace, botnet analysis, distributed troubleshooting, distributed forcasting… AS5 AS2 AS3 AS4 AS1

What does it take to make this work? 5 Domains produce data about their operations. Domains use similar data formats. Domains allow each other to query their data. AS5 AS2 AS3 AS4 AS1 NetFlow SFlow IPFIX Sampled NetFlow

Why are domains reluctant to share data? 6 Privacy is difficult even if you have the best intentions Even after anonymization (Netflix de-anonymization case) Or aggregation (auxiliary information attack) To make a ‘knowledge plane’ work, we need strong privacy guarantees! Idea: differential privacy. Netflix de-anonymization AOL searcher exposed

Differential privacy 7 Differential privacy: What: provide very strict privacy guarantee for individuals. ‘Worst-case’ adversary Tunable amount of privacy Composable query costs But, there are caveats too: Limited query budget. Gives noised answer. Distributed DP is hard. … Differential privacy: a good candidate? Our hypothesis: Yes!

Outline - Motivation - Challenges - PRISM: Private Retrieval of the Internet’s Sensitive Metadata - The vision - Do we have enough budget? - What about data quality? - Can we deal with attackers? - Can we answer all types of queries? - What about privacy for ISPs? - Conclusion 8

PRISM: differential privacy on Internet data 9 PRISM: a system sketch Domains keep their data local. PRISM nodes manage local data and answer queries. Query answers released with differential privacy. Result: private Internet knowledge plane

Background: Differential privacy 10 How: noise query answer before release E.g., noise drawn from a Laplace distribution parameterized by ε. ε: privacy parameter; larger values = more privacy release. Guarantee: Query answer on ‘neighboring databases’ are very similar. We can view ε as a privacy budget: The total amount of privacy we are willing to release. Each query uses up some budget. Refuse further queries once budget is depleted.

Challenges 11 Do we have enough budget? Can we detect attacks with noised data? What about compromised PRISM nodes? Does PRISM provide privacy for ISPs, too? Would PRISM work with a partial deployment? Can we make all queries differentially private? Would PRISM’s query processor scale? … See paper

The privacy budget 12 The budget problem: ɛ sets a hard limit on how many queries PRISM can answer. Many ways to set ɛ [e.g., Hsu-CSF-2013] No matter how large, budget eventually runs out.

Challenge #1: enough budget? 13 The Internet data presents unique opportunities! Large size: queries cost less. E.g., counting queries about IP addresses. Assume that the answer is 40 million, we want released answer to be 10% within true answer with 95% confidence N = 667,616. Per ISP: ~10 queries.

Challenge #1: enough budget? 14 Sampling: reduces query cost Internet data is typically sampled, e.g., NetFlow is typically sampled at 1/4K. Theoretical result: sampling at rate α reduces cost to α*ε. We further sample NetFlow records by ~50%. Per ISP: ~100,000 queries.

Challenge #1: enough budget? 15 We probably don’t have a worst-case adversary! ISPs are competitors, so won’t collude on a large scale. Conservatively, if no two ISPs collude, we can give each ISP its own budget. This scales up budget significantly. Even there are small-scale collusions, per ISP: 400 million queries are within reach (1K queries per ISP per day for 1,000 years.)

Challenge #1: enough budget? 16 Can we replenish the budget? Internet data is fast changing E.g., many flows expire in seconds E.g., IP-to-user mappings also change E.g., 40% of /24 address blocks are dynamic Eventually, the DB may become entirely different, e.g., in 100 years, most users should be different. There should be opportunity for replenishing the budget when users are completely different.

Challenge #2: data quality? 17 The data quality problem: if DP adds noise, can we still detect attacks accurately? DP’s noise is easy to interpret! Well-known distribution: Laplace. Dealing with imprecision: well understood topic. Works on true data: instead of inferred data. We are looking for large trends, e.g., DDoS, bots.

Challenge #3: compromised nodes? 18 What if PRISM nodes are compromised? There are things we can do, too! Hackers are unlikely to take over the majority of nodes. Quality-checking can be integrated with queries. [Reed ICFP] Queries answers can be released verifiably [Narayan Eurosys]

Other challenges 19 Challenge #4: Difficult queries Challenge #5: Privacy for ISPs Challenge #6: Partial deployment Challenge #7: Scaling the query processor … Please read paper for details.

Conclusion 20 Motivation: Internet-wide threats Primary challenge: privacy concern Proposal: PRISM Differential privacy for Internet data Feasibility Privacy budget Noised data for detection? Compromised nodes? … Questions?